domains / families / security / supply-chain-risk-auditor

supply-chain-risk-auditor

combined

Identifies dependencies at heightened risk of exploitation or takeover. Use when assessing supply chain attack surface, evaluating dependency health, or scoping security engagements. Audits a project's dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree, abandoned or archived upstreams, npm publisher concentration, and install-time script execution. Use when asked to audit dependencies, assess supply-chain or third-party package risk, or review a dependency tree before an engagement.

When to use

• Assessing dependency risk before a security audit
• Evaluating supply chain attack surface of a project
• Identifying unmaintained or risky dependencies
• Pre-engagement scoping for supply chain concerns
• **Single maintainer or team of individuals** - The project is primarily or solely maintained by a single individual, or a small number of individuals. The project is not managed by an organization such as the Linux Foundation or a company…
• **Unmaintained** - The project is stale (no updates for a long period of time) or explicitly deprecated/archived. The maintainer may have put a note in the README.md or a GitHub issue that the project is inactive, understaffed, or seeking…
• **Low popularity:** The project has a relatively low number of GitHub stars and/or downloads compared to other dependencies used by the target. **Justification:** Fewer users means fewer eyes on the project. If malicious code is introduced…
• **High-risk features:** The project implements features that by their nature are especially prone to exploitation, including FFI, deserialization, or third-party code execution. **Justification:** These dependencies are key to the target's…

When not to use

• Active vulnerability scanning (use dedicated tools like npm audit, pip-audit)
• Runtime dependency analysis
• License compliance auditing
• Use this skill only when the task clearly matches the scope described above.
• Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
• Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.
• License compliance auditing.
• Scanning the target's own source for vulnerabilities or secrets — this skill never

Skill page

Conflict

The two copies describe different procedures for the same task. The trailofbits copy is a deterministic, script-driven audit that forbids manual estimation, enforces a strict 'unassessable is not risk' epistemology, and produces a rendered report from a collector. The sickn33 copy is a manual, judgment-driven audit that explicitly requires using `gh` to count stars and issues, applies subjective risk criteria (e.g., maintainer anonymity, low popularity), and produces a narrative report with suggested alternatives. They disagree on the core methodology (scripts vs. manual `gh` queries) and the definition of risk (measured criteria vs. qualitative red flags). Crowning one would hide a valid alternative approach to supply chain auditing.